pi-commandcode-provider 0.5.0 → 0.6.0

package/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 ## Unreleased
 
+## 0.6.0 - 2026-08-25
+
+- Allow switching from a vision-capable model to a text-only model by omitting historical image tool results while preserving their text output; direct image prompts still fail clearly.
+- Stream incremental tool-call arguments from the `/alpha/generate` transport instead of waiting for the final complete tool-call event.
+- Add a daily GitHub Actions synchronization job that opens or updates a pull request for CLI version, image capability, reasoning, effort, and output-limit changes in the latest published Command Code catalog.
+- Refresh static model capabilities from `command-code@1.32.2`, separating reasoning support from selectable effort levels and honoring model-specific output limits.
+- Reject truncated, aborted, and network-failed generate streams instead of reporting partial responses as successful.
+- Normalize malformed tool results and synthesize missing tool results so follow-up requests preserve valid tool-call history.
+- Refresh display pricing for all 58 current models, including Gemini 3.7 Flash, Qwen 3.8 27B, Ox Alpha, Muse Spark 1.2, and Grok 4.6 long-context rates.
+- Accept the official `COMMAND_CODE_API_KEY` and `CMD_ZDR` environment variables while retaining legacy aliases.
+- Align generate request metadata with the CLI by forwarding stable session IDs, optional temperature, and the CLI user agent.
+- Validate manually pasted API keys, use the CLI's two-minute browser timeout, and reject OAuth state mismatches without closing the callback server.
+- Add `/commandcode-quota` with live credits, plan, usage totals, and rolling-limit diagnostics from Command Code's alpha usage endpoints.
+- Add `zai-org/GLM-5.3` with its verified reasoning efforts and display pricing.
+- Prefer Command Code's Provider API (`/provider/v1/chat/completions` and `/provider/v1/messages`) and automatically fall back to the existing `/alpha/generate` transport only when the Provider API returns `403 upgrade_required` for a Go-plan account.
+- Remember the detected transport for the running process, re-detect it when credentials change, prevent stale in-flight requests from overwriting the new credential's transport, and never fall back for unrelated authentication, permission, rate-limit, network, or server failures.
+- Use Pi's native OpenAI- and Anthropic-compatible providers for Provider API streaming, including adaptive thinking for current reasoning-capable Claude models, while preserving the existing hardened generate transport, dynamic model discovery, offline cache, refresh/status commands, pricing, and OAuth credentials.
+- Let `/login` use browser authentication, an explicit API-key prompt, or a directly pasted API key.
+- Add optional zero-data-retention headers through `CMD_ZDR=1` and the legacy `COMMANDCODE_ZDR=1` alias.
+- Refresh GPT-5.6 Terra and Luna display prices after their temporary 50% promotion ended, and display the current DeepSeek V4 off-peak rates for its time-dependent pricing.
+- Add isolated live E2E profiles for separate Go-, GOAT-, and Provider-plan credentials, covering transport selection, reasoning across turns, quota identity, aborts, tools, GOAT vision, Go image rejection, and packed-package validation.
+- Fix extension load failure on newer pi hosts that reject registering a custom API under a built-in name (`openai-completions`); register under `commandcode-custom` instead and restore the real wire API before native compat dispatch.
+
+### Contributors
+
+- @jagaliano — added the live quota dashboard and hardened its integration.
+- @omariqbalnaru — fixed custom API registration for Oh My Pi 17.4.0.
+- @ThomasByr — added GLM-5.3 pricing and reasoning levels.
+- @newCman1 — added DeepSeek V4 vision model support.
+
+## 0.5.1 - 2026-08-11
+
+- Add model-specific image input capabilities from the `command-code@1.15.1` catalog and forward user and tool-result images using the current Command Code wire format.
+- Update the Command Code client version header to `1.15.1`.
+
+### Contributors
+
+- @DiyarD — reported missing vision support for GPT-5.6 Luna, Muse Spark 1.2, and other vision-capable models.
+
 ## 0.5.0 - 2026-08-07
 
 - Stop replaying completed assistant reasoning traces to Command Code while preserving visible text and completed tool calls in follow-up request history.

package/CONTRIBUTING.md

@@ -42,6 +42,16 @@ npm run pi:authenticated
 
 Both commands accept additional pi arguments after `--`, for example `npm run pi:authenticated -- --model claude-sonnet-4-6`.
 
+Run the transport-specific live tests with separate credentials:
+
+```sh
+COMMANDCODE_E2E_GO_API_KEY_FILE=/path/to/go-key npm run test:e2e:live:go
+COMMANDCODE_E2E_GOAT_API_KEY_FILE=/path/to/goat-key npm run test:e2e:live:goat
+COMMANDCODE_E2E_PROVIDER_API_KEY_FILE=/path/to/provider-key npm run test:e2e:live:provider
+```
+
+Use `npm run test:e2e:live:all` with the Go and GOAT file variables to run both subscription transports sequentially. Store keys in a secret manager and export each one to a new mode-`0600` temporary file for the test; never add key files to the repository. Direct `*_API_KEY` variables are intended primarily for protected CI secrets.
+
 Before opening a PR, run:
 
 ```sh

package/README.md

@@ -5,7 +5,7 @@
 
 A custom provider for [pi](https://github.com/earendil-works/pi) that connects to the [Command Code](https://commandcode.ai) Provider API.
 
-> **Disclaimer:** This is an unofficial, community-maintained integration. It is not affiliated with, endorsed by, or supported by Command Code. You need your own Command Code account and API key or subscription. Command Code's terms, availability, and pricing apply.
+> **Disclaimer:** This is an unofficial, community-maintained integration. It is not affiliated with, endorsed by, or supported by Command Code. You need your own Command Code account, API key, and a plan with Provider API access. Command Code's terms, availability, and pricing apply.
 
 ## Install
 
@@ -19,7 +19,7 @@ Start or reload pi, then authenticate:
 /login
 ```
 
-Select **Use a subscription**, then **Command Code**. Complete the browser flow and choose a model with `/model`.
+Select **Use a subscription**, then **Command Code**. Choose browser login or paste an API key, then select a model with `/model`.
 
 ## Oh My Pi
 
@@ -33,9 +33,9 @@ Restart OMP or run `/reload`, then use `/login` and select **Use a subscription*
 
 ## Authentication
 
-### Browser login
+### Login dialog
 
-Run `/login` in pi or OMP. Select **Use a subscription**, then **Command Code**. The browser flow stores the returned credential in the host's auth file.
+Run `/login` in pi or OMP. Select **Use a subscription**, then **Command Code**. Press Enter for browser login, type `key` to open a paste prompt, or paste the API key directly. The selected credential is stored in the host's auth file.
 
 <img width="1520" height="554" alt="Select Command Code in pi's login dialog" src="https://github.com/user-attachments/assets/071e929a-6f49-4803-bfec-7a31368fb12a" />
 
@@ -44,7 +44,7 @@ If automatic transfer from the browser fails, copy the API key shown by Command
 ### Environment variable
 
 ```sh
-export COMMANDCODE_API_KEY="user_..."
+export COMMAND_CODE_API_KEY="user_..."
 ```
 
 ### Auth file
@@ -84,9 +84,7 @@ Open `/model` and select one of the models provided by Command Code. Model avail
 
 ### Reasoning support
 
-Reasoning metadata is enriched only for models whose Command Code effort support is known. Those models register a model-specific `thinkingLevelMap`, so pi and OMP expose only supported levels. A selected supported level is sent as the documented `params.reasoning_effort` field; `off`, unsupported levels, and newly discovered models without metadata do not add reasoning fields to the request. No prompt instructions are injected.
-
-Reasoning blocks from completed assistant turns remain visible in pi's local session, but are not replayed to Command Code in later requests. Only the assistant's user-visible text and completed tool calls are sent back as history. This matches the current Command Code CLI behavior and prevents prior private reasoning traces from interfering with reasoning on follow-up turns.
+Reasoning capability and selectable effort levels follow the official CLI catalog independently. Models can therefore be marked as reasoning-capable even when Command Code chooses their depth automatically. Models with explicit effort support also register a model-specific `thinkingLevelMap`, so pi and OMP expose only valid levels. Pi's native OpenAI- and Anthropic-compatible providers translate the selected level for Provider API accounts; the existing Command Code generate transport sends the matching `reasoning_effort` for Go accounts.
 
 List Command Code models from the terminal:
 
@@ -122,6 +120,11 @@ While pi is running, use these provider commands without restarting:
 
 - `/commandcode-refresh` fetches and re-registers the current model catalog. Overlapping refreshes are coalesced, and a failed refresh keeps the last valid catalog active.
 - `/commandcode-status` shows redacted discovery diagnostics, including the source, model count, timestamps, cache path, endpoint, and warning.
+- `/commandcode-quota` shows your Command Code account usage and quota in a dashboard-style layout: credits remaining and used with a percentage, monthly/purchased/free sources, the current plan, available usage totals, the API key name, and the 5-hour and weekly usage windows.
+
+The `commandcode-quota` command reads from the Command Code alpha usage endpoints (the same ones the `cmd` CLI `/usage` command uses): `whoami`, `billing/credits`, `billing/subscriptions`, and `usage/summary`. It authenticates with the same API key the provider already uses. If the command cannot reach those endpoints or an endpoint schema changes, unavailable sections are reported explicitly instead of being displayed as zero usage. Output is plain text (via `ui.notify`) so it works across pi and compatible hosts such as OMP.
+
+Set `CMD_ZDR=1` to send Command Code's documented `x-cmd-zdr: 1` zero-data-retention header. The legacy `COMMANDCODE_ZDR=1` alias remains supported.
 
 The following environment variables are intended for tests, local mocks, and compatible API endpoints:
 
@@ -132,15 +135,15 @@ The following environment variables are intended for tests, local mocks, and com
 
 ## Image input
 
-This provider currently advertises and accepts **text input only**. The extension uses Command Code's legacy `/alpha/generate` protocol, while the public Provider API documentation describes image parts for its documented `/provider/v1` endpoints. The legacy request path has no documented image-part contract, and the model catalog fixture exposes model IDs and context lengths but no image capability or limit fields.
+The provider advertises image input only for models marked with the `image` input modality in the official Command Code CLI model catalog. The capability snapshot currently follows `command-code@1.32.2`; unknown models default to text-only until their upstream metadata is reviewed. A daily GitHub Actions job synchronizes the CLI version, image capabilities, reasoning flags, reasoning efforts, and model-specific output limits with the latest published CLI package and opens or updates a reviewable pull request when they change. Pricing remains manually reviewed because temporary promotions and long-context tiers require explicit review.
 
-To avoid silently dropping or changing image data, the provider rejects image content in user messages and tool results before making a network request. It does not claim image capability or define image-size/count limits. This limitation can be revisited when Command Code documents image parts and limits for the protocol used here.
+For vision-capable models, Pi's native provider adapters forward image blocks from user messages and tool results using the documented OpenAI or Anthropic message schema. Unknown and text-only models remain marked text-only in Pi.
 
 ## Pricing display
 
-The Command Code Provider API does not currently include prices in its model catalog. This extension therefore keeps a static table for models with known prices so pi can display estimated request costs.
+The Command Code Provider API does not currently include prices in its model catalog. This extension therefore keeps a static table for models with known prices so pi can display estimated request costs. DeepSeek V4 uses time-dependent rates; pi displays the documented off-peak rate, which applies for 17 hours per day.
 
-Models missing from that table display zero cost in pi. This does **not** mean that Command Code will bill the request at zero. Check the current [Command Code pricing](https://commandcode.ai/docs/resources/pricing-limits) before relying on the displayed value.
+Models missing from that table display zero cost in pi. This does **not** mean that Command Code will bill the request at zero. The Command Code Usage page remains authoritative for each request. Check the current [Command Code pricing](https://commandcode.ai/docs/resources/pricing-limits) before relying on the displayed value.
 
 ## Update and remove
 
@@ -181,6 +184,29 @@ npm run pi:authenticated
 
 Both commands accept additional pi arguments after `--`, for example `npm run pi:authenticated -- --model claude-sonnet-4-6`.
 
+### Live transport tests
+
+Keep Go-, GOAT-, and optional Provider-plan test keys in separate secret-manager entries. Pass them through protected files so the keys do not enter shell history:
+
+```sh
+COMMANDCODE_E2E_GO_API_KEY_FILE=/path/to/go-key \
+  npm run test:e2e:live:go
+
+COMMANDCODE_E2E_GOAT_API_KEY_FILE=/path/to/goat-key \
+  npm run test:e2e:live:goat
+
+COMMANDCODE_E2E_PROVIDER_API_KEY_FILE=/path/to/provider-key \
+  npm run test:e2e:live:provider
+
+COMMANDCODE_E2E_GO_API_KEY_FILE=/path/to/go-key \
+COMMANDCODE_E2E_GOAT_API_KEY_FILE=/path/to/goat-key \
+  npm run test:e2e:live:all
+```
+
+Each profile runs with an isolated Pi agent directory and asserts transport selection, reasoning across turns, quota plan identity, abort handling, tool calls, and the packed npm artifact. Go must select `generate` and reject unsupported images; GOAT must select `provider` and complete a live vision request. The profile-specific `*_API_KEY` environment variables are also supported for CI secrets, but key files are preferred for local use.
+
+The Go profile defaults to DeepSeek V4 Flash; GOAT defaults to Grok 4.6 because its Provider API stream exposes reasoning consistently across consecutive turns. Override them with `COMMANDCODE_E2E_GO_MODEL`, `COMMANDCODE_E2E_GOAT_MODEL`, or `COMMANDCODE_E2E_PROVIDER_MODEL`. A successful live Anthropic `/provider/v1/messages` test requires a paid account whose plan includes the selected Claude model.
+
 See [CONTRIBUTING.md](CONTRIBUTING.md) for local setup and tests. See [RELEASE.md](RELEASE.md) for the release process.
 
 ## License

package/index.ts

@@ -1,12 +1,12 @@
 /**
  * Command Code provider for pi.
  *
- * Connects pi to Command Code's API (https://api.commandcode.ai/alpha/generate).
- * The provider uses pi's legacy extension registration surface because the
- * current pi host exposes `registerProvider(name, config)`, including OMP.
+ * Uses Command Code's documented Provider API:
+ * https://api.commandcode.ai/provider/v1
  */
 
 import { AssistantMessageEventStream } from "@earendil-works/pi-ai"
+import { streamSimple as streamNativeProvider } from "@earendil-works/pi-ai/compat"
 import {
   getAgentDir,
   type ExtensionAPI,
@@ -15,83 +15,109 @@ import {
 } from "@earendil-works/pi-coding-agent"
 import { join } from "node:path"
 
-import {
-  COMMAND_CODE_CLI_VERSION,
-  COMMAND_CODE_INPUT_TYPES,
-  createStreamCommandCode,
-  DEFAULT_API_BASE,
-} from "./src/core.ts"
+import { getConfiguredApiKey } from "./src/api-key.ts"
+import { createStreamCommandCode } from "./src/core.ts"
 import { calculateCommandCodeCost } from "./src/cost.ts"
 import {
+  apiForModelId,
+  baseUrlForModel,
   DEFAULT_MODELS_URL,
+  DEFAULT_PROVIDER_API_BASE,
   getModelsTimeoutMs,
+  inputModalitiesForModel,
   loadCommandCodeModels,
+  MODEL_EFFORTS,
   thinkingMetadataForModel,
   type CommandCodeModel,
 } from "./src/models.ts"
 import { getApiKey as getOAuthApiKey, login, refreshToken } from "./src/oauth.ts"
+import { normalizeCommandCodeMessage } from "./src/overflow.ts"
 import { MODEL_COSTS, ZERO_MODEL_COST } from "./src/pricing.ts"
+import { registerCommandCodeQuota } from "./src/quota-command.ts"
 import { createCommandCodeRuntime } from "./src/runtime.ts"
-import { normalizeCommandCodeMessage } from "./src/overflow.ts"
+import { createCommandCodeTransportRouter } from "./src/transport.ts"
+
+function commandCodeHeaders(): Record<string, string> | undefined {
+  if (process.env.CMD_ZDR === "1" || process.env.COMMANDCODE_ZDR === "1") {
+    return { "x-cmd-zdr": "1" }
+  }
+  return undefined
+}
 
 function createProviderConfig(
   models: readonly CommandCodeModel[],
   apiBase: string,
   streamCommandCode: ProviderConfig["streamSimple"],
 ): ProviderConfig {
+  const headers = commandCodeHeaders()
   return {
     name: "Command Code",
     baseUrl: apiBase,
-    // Keep environment authentication dynamic. OAuth credentials are resolved
-    // by pi's oauth registration, while the custom stream retains its own
-    // request-time legacy-file fallback for older compatible hosts.
-    apiKey: "$COMMANDCODE_API_KEY",
-    authHeader: true,
+    apiKey: getConfiguredApiKey() ?? "$COMMAND_CODE_API_KEY",
     api: "commandcode-custom",
     streamSimple: streamCommandCode,
-    headers: {
-      "x-command-code-version": COMMAND_CODE_CLI_VERSION,
-      "x-cli-environment": "production",
-    },
+    headers,
     oauth: {
       name: "Command Code",
       login,
       refreshToken,
       getApiKey: getOAuthApiKey,
     },
-    models: models.map(createProviderModel),
+    models: models.map((model) => ({
+      id: model.id,
+      name: model.name,
+      api: "commandcode-custom",
+      baseUrl: baseUrlForModel(apiBase, model.api),
+      reasoning: model.reasoning,
+      ...(thinkingMetadataForModel(model.id) ?? {}),
+      input: [...inputModalitiesForModel(model.id)],
+      cost: MODEL_COSTS[model.id] ?? ZERO_MODEL_COST,
+      contextWindow: model.contextWindow,
+      maxTokens: model.maxTokens,
+      headers,
+      compat:
+        model.api === "openai-completions"
+          ? {
+              supportsStore: false,
+              supportsDeveloperRole: false,
+              supportsReasoningEffort: MODEL_EFFORTS[model.id] !== undefined,
+              maxTokensField: "max_tokens",
+            }
+          : {
+              supportsEagerToolInputStreaming: false,
+              supportsLongCacheRetention: false,
+              supportsCacheControlOnTools: false,
+              supportsToolReferences: false,
+              ...(model.reasoning ? { forceAdaptiveThinking: true } : {}),
+            },
+    })),
   }
 }
 
-function createProviderModel(model: {
-  id: string
-  name: string
-  reasoning: boolean
-  contextWindow: number
-  maxTokens: number
-}) {
-  return {
-    id: model.id,
-    name: model.name,
-    reasoning: model.reasoning,
-    ...(thinkingMetadataForModel(model.id) ?? {}),
-    input: COMMAND_CODE_INPUT_TYPES,
-    cost: MODEL_COSTS[model.id] ?? ZERO_MODEL_COST,
-    contextWindow: model.contextWindow,
-    maxTokens: model.maxTokens,
-  } as const
+function legacyApiBase(providerApiBase: string): string {
+  return providerApiBase.replace(/\/provider\/v1\/?$/, "")
 }
 
 export default async function (pi: ExtensionAPI) {
-  const apiBase = process.env.COMMANDCODE_API_BASE ?? DEFAULT_API_BASE
+  const apiBase = process.env.COMMANDCODE_API_BASE ?? DEFAULT_PROVIDER_API_BASE
   const modelsUrl = process.env.COMMANDCODE_MODELS_URL ?? DEFAULT_MODELS_URL
   const modelsTimeoutMs = getModelsTimeoutMs()
   const modelsCachePath =
     process.env.COMMANDCODE_MODELS_CACHE ?? join(getAgentDir(), "commandcode-models.json")
-  const streamCommandCode = createStreamCommandCode({
+  const streamGenerate = createStreamCommandCode({
     createStream: () => new AssistantMessageEventStream(),
     calculateCost: calculateCommandCodeCost,
-    apiBase,
+    apiBase: legacyApiBase(apiBase),
+  })
+  const transport = createCommandCodeTransportRouter({
+    createStream: () => new AssistantMessageEventStream(),
+    streamProvider: (model, context, options) =>
+      streamNativeProvider(
+        { ...model, api: apiForModelId(model.id), compat: model.compatConfig ?? model.compat },
+        context,
+        options,
+      ),
+    streamGenerate,
   })
 
   pi.on("message_end", async (event, ctx) => {
@@ -100,6 +126,11 @@ export default async function (pi: ExtensionAPI) {
     return normalized ? { message: normalized.message } : undefined
   })
 
+  registerCommandCodeQuota(pi, {
+    apiBase: legacyApiBase(apiBase),
+    headers: commandCodeHeaders(),
+  })
+
   const runtime = createCommandCodeRuntime<ProviderConfig, ExtensionCommandContext>(pi, {
     endpoint: modelsUrl,
     cachePath: modelsCachePath,
@@ -109,7 +140,8 @@ export default async function (pi: ExtensionAPI) {
         cachePath: modelsCachePath,
         timeoutMs: modelsTimeoutMs,
       }),
-    createProviderConfig: (models) => createProviderConfig(models, apiBase, streamCommandCode),
+    createProviderConfig: (models) => createProviderConfig(models, apiBase, transport.stream),
+    getTransport: transport.getTransport,
   })
 
   await runtime.initialize()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-commandcode-provider",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "pi custom provider for Command Code API (commandcode.ai)",
   "type": "module",
   "keywords": [
@@ -29,14 +29,18 @@
     "LICENSE"
   ],
   "scripts": {
-    "test": "npm run typecheck && tsx tests/test-package-manifest.ts && tsx tests/test-pure-functions.ts && tsx tests/test-models.ts && tsx tests/test-runtime.ts && tsx tests/test-pricing.ts && tsx tests/test-cost.ts && tsx tests/test-oauth.ts && tsx tests/test-abort.ts && tsx tests/test-overflow.ts && tsx tests/test-stream.ts && tsx tests/test-retry.ts && node tests/test-pi-isolated.mjs && node tests/test-pi-authenticated.mjs && node tests/test-pi-local.mjs && node tests/test-omp-compat.mjs",
+    "test": "npm run typecheck && tsx tests/test-package-manifest.ts && tsx tests/test-api-key.ts && tsx tests/test-pure-functions.ts && tsx tests/test-models.ts && tsx tests/test-model-metadata-check.ts && tsx tests/test-runtime.ts && tsx tests/test-pricing.ts && tsx tests/test-cost.ts && tsx tests/test-oauth.ts && tsx tests/test-abort.ts && tsx tests/test-overflow.ts && tsx tests/test-stream.ts && tsx tests/test-quota.ts && tsx tests/test-quota-command.ts && tsx tests/test-retry.ts && tsx tests/test-transport.ts && node tests/test-pi-isolated.mjs && node tests/test-pi-authenticated.mjs && node tests/test-pi-local.mjs && node tests/test-omp-compat.mjs",
     "typecheck": "tsc --noEmit",
     "format:check": "prettier --check '**/*.{ts,mjs,json,md}'",
     "format": "prettier --write '**/*.{ts,mjs,json,md}'",
     "pi:isolated": "node scripts/pi-isolated.mjs",
     "pi:authenticated": "node scripts/pi-authenticated.mjs",
-    "test:unit": "tsx tests/test-pure-functions.ts",
-    "test:models": "tsx tests/test-models.ts",
+    "check:commandcode-catalog": "tsx .github/scripts/check-commandcode-model-metadata.ts command-code@latest",
+    "sync:commandcode-catalog": "tsx .github/scripts/check-commandcode-model-metadata.ts command-code@latest --write",
+    "test:quota": "tsx tests/test-quota.ts && tsx tests/test-quota-command.ts",
+    "test:unit": "tsx tests/test-api-key.ts && tsx tests/test-pure-functions.ts && tsx tests/test-models.ts && tsx tests/test-model-metadata-check.ts && tsx tests/test-runtime.ts && tsx tests/test-pricing.ts && tsx tests/test-cost.ts && tsx tests/test-oauth.ts && tsx tests/test-abort.ts && tsx tests/test-overflow.ts && tsx tests/test-stream.ts && tsx tests/test-quota.ts && tsx tests/test-quota-command.ts && tsx tests/test-retry.ts && tsx tests/test-transport.ts",
+    "test:api-key": "tsx tests/test-api-key.ts",
+    "test:models": "tsx tests/test-models.ts && tsx tests/test-model-metadata-check.ts",
     "test:runtime": "tsx tests/test-runtime.ts",
     "test:pricing": "tsx tests/test-pricing.ts",
     "test:oauth": "tsx tests/test-oauth.ts",
@@ -44,11 +48,16 @@
     "test:overflow": "tsx tests/test-overflow.ts",
     "test:stream": "tsx tests/test-stream.ts",
     "test:retry": "tsx tests/test-retry.ts",
+    "test:transport": "tsx tests/test-transport.ts",
     "test:pi-isolated": "node tests/test-pi-isolated.mjs",
     "test:pi-authenticated": "node tests/test-pi-authenticated.mjs",
     "test:pi-local": "node tests/test-pi-local.mjs",
     "test:smoke": "node tests/test-smoke.mjs",
     "test:e2e:live": "node tests/test-live-e2e.mjs",
+    "test:e2e:live:go": "node scripts/live-e2e-profile.mjs go",
+    "test:e2e:live:goat": "node scripts/live-e2e-profile.mjs goat",
+    "test:e2e:live:provider": "node scripts/live-e2e-profile.mjs provider",
+    "test:e2e:live:all": "node scripts/live-e2e-profile.mjs go goat",
     "test:cost": "tsx tests/test-cost.ts"
   },
   "pi": {

package/scripts/live-e2e-profile.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import { spawn } from "node:child_process"
+import { readFile } from "node:fs/promises"
+import { dirname, resolve } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const projectDir = resolve(dirname(fileURLToPath(import.meta.url)), "..")
+const liveTest = resolve(projectDir, "tests", "test-live-e2e.mjs")
+const profiles = process.argv.slice(2)
+
+if (
+  profiles.length === 0 ||
+  profiles.some((profile) => profile !== "go" && profile !== "goat" && profile !== "provider")
+) {
+  console.error("Usage: node scripts/live-e2e-profile.mjs <go|goat|provider> [go|goat|provider]")
+  process.exit(2)
+}
+
+async function credentialFor(profile) {
+  const prefix =
+    profile === "go"
+      ? "COMMANDCODE_E2E_GO"
+      : profile === "goat"
+        ? "COMMANDCODE_E2E_GOAT"
+        : "COMMANDCODE_E2E_PROVIDER"
+  const direct = process.env[`${prefix}_API_KEY`]?.trim()
+  const file = process.env[`${prefix}_API_KEY_FILE`]
+
+  if (direct && file)
+    throw new Error(`${prefix}_API_KEY and ${prefix}_API_KEY_FILE are mutually exclusive`)
+  if (direct) return direct
+  if (file) {
+    const credential = (await readFile(file, "utf-8")).trim()
+    if (credential) return credential
+  }
+
+  throw new Error(`Set ${prefix}_API_KEY_FILE (recommended) or ${prefix}_API_KEY`)
+}
+
+function runProfile(profile, apiKey) {
+  const modelVariable =
+    profile === "go"
+      ? "COMMANDCODE_E2E_GO_MODEL"
+      : profile === "goat"
+        ? "COMMANDCODE_E2E_GOAT_MODEL"
+        : "COMMANDCODE_E2E_PROVIDER_MODEL"
+  const model =
+    process.env[modelVariable] ??
+    (profile === "goat" ? "xai/grok-4.6" : "deepseek/deepseek-v4-flash")
+  const env = {
+    ...process.env,
+    COMMAND_CODE_API_KEY: apiKey,
+    COMMANDCODE_E2E_MODEL: model,
+    COMMANDCODE_E2E_PROFILE: profile,
+  }
+  delete env.COMMANDCODE_API_KEY
+  delete env.COMMANDCODE_E2E_GO_API_KEY
+  delete env.COMMANDCODE_E2E_GOAT_API_KEY
+  delete env.COMMANDCODE_E2E_PROVIDER_API_KEY
+
+  return new Promise((resolveRun, reject) => {
+    console.log(`[live-e2e:${profile}] model ${model}`)
+    const child = spawn(process.execPath, [liveTest], {
+      cwd: projectDir,
+      env,
+      stdio: "inherit",
+    })
+    child.on("error", reject)
+    child.on("close", (code, signal) => {
+      if (code === 0) {
+        resolveRun()
+        return
+      }
+      reject(new Error(`[live-e2e:${profile}] failed (${signal ?? `exit ${code}`})`))
+    })
+  })
+}
+
+try {
+  for (const profile of profiles) {
+    await runProfile(profile, await credentialFor(profile))
+  }
+} catch (error) {
+  console.error(error instanceof Error ? error.message : String(error))
+  process.exit(1)
+}

package/scripts/pi-authenticated.mjs

@@ -11,6 +11,7 @@ const env = {
   ...process.env,
   PI_SKIP_VERSION_CHECK: "1",
 }
+delete env.COMMAND_CODE_API_KEY
 delete env.COMMANDCODE_API_KEY
 
 const child = spawn(

package/scripts/pi-isolated.mjs

@@ -22,6 +22,7 @@ const env = {
   PI_CODING_AGENT_SESSION_DIR: sessionDir,
   PI_SKIP_VERSION_CHECK: "1",
 }
+delete env.COMMAND_CODE_API_KEY
 delete env.COMMANDCODE_API_KEY
 
 let activeChild

package/src/api-key.ts

@@ -0,0 +1,69 @@
+import { existsSync, readFileSync } from "node:fs"
+import { homedir } from "node:os"
+import { join } from "node:path"
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+function stringValue(value: unknown): string | undefined {
+  return typeof value === "string" ? value : undefined
+}
+
+function defaultAuthPaths(home: string): string[] {
+  return [
+    join(home, ".commandcode", "auth.json"),
+    join(home, ".pi", "agent", "auth.json"),
+    join(home, ".omp", "agent", "auth.json"),
+  ]
+}
+
+function apiKeyFromCredential(value: unknown): string | undefined {
+  if (!isRecord(value)) return undefined
+
+  if (stringValue(value.type) === "oauth") return stringValue(value.access)
+  if (stringValue(value.type) === "api") return stringValue(value.key)
+  return stringValue(value.access) ?? stringValue(value.key)
+}
+
+export function getConfiguredApiKey(
+  options: {
+    env?: NodeJS.ProcessEnv
+    authPaths?: readonly string[]
+    homeDir?: () => string
+  } = {},
+): string | undefined {
+  const env = options.env ?? process.env
+  if (env.COMMAND_CODE_API_KEY) return env.COMMAND_CODE_API_KEY
+  if (env.COMMANDCODE_API_KEY) return env.COMMANDCODE_API_KEY
+
+  const home = options.homeDir?.() ?? homedir()
+  const authPaths = options.authPaths ?? defaultAuthPaths(home)
+
+  for (const authPath of authPaths) {
+    try {
+      if (!existsSync(authPath)) continue
+      const parsed: unknown = JSON.parse(readFileSync(authPath, "utf-8"))
+      if (!isRecord(parsed)) continue
+
+      const apiKey = stringValue(parsed.apiKey)
+      if (apiKey) return apiKey
+
+      const commandcode = stringValue(parsed.commandcode)
+      if (commandcode) return commandcode
+
+      const providerKey = apiKeyFromCredential(parsed.commandcode)
+      if (providerKey) return providerKey
+
+      const commandCode = stringValue(parsed["command-code"])
+      if (commandCode) return commandCode
+
+      const commandCodeKey = apiKeyFromCredential(parsed["command-code"])
+      if (commandCodeKey) return commandCodeKey
+    } catch {
+      // Ignore malformed or unreadable auth files.
+    }
+  }
+
+  return undefined
+}

package/src/auth-server.ts

@@ -28,6 +28,7 @@ export interface AuthServer {
 export interface AuthServerOptions {
   startPort?: number
   portRange?: number
+  expectedState?: string
 }
 
 function listenOnAvailablePort(
@@ -181,6 +182,12 @@ export async function startAuthServer(options: AuthServerOptions = {}): Promise<
           return
         }
 
+        if (options.expectedState !== undefined && state !== options.expectedState) {
+          res.writeHead(403)
+          res.end(JSON.stringify({ success: false, error: "Invalid state token" }))
+          return
+        }
+
         res.writeHead(200)
         res.end(JSON.stringify({ success: true }))